ypserv hostbased limit的一个问题

cxfcxf

my NIS server is 192.168.0.1 and NIS client is 192.168.0.2

i copyed /usr/share/doc/ypserv-xxx/securenets to Dir /var/yp
edited it as follow

# This line gives access to everybody. PLEASE ADJUST!
#0.0.0.0                0.0.0.0
255.255.255.0           192.168.0.2

my NIS client can not get any NIS info

but if i edit is as
255.255.255.0           192.168.0.0

that's OK now...

我的问题是。。看了securenets的说明 说是里面加入的是允许的主机
我的情况怎么这么怪？？
This file contains netmask/network pairs.
network pairs理解为 网段的话。。。就说得通了。。不过那就没办法限制单台主机
例如192.168.0.3 这样在一个网段内的

yongjian

192.168.0.3不是网段，只是单机。NIS没有办法限制单个的IP。用iptables吧。

cxfcxf

This file contains netmask/network pairs.
果然这句话network pairs只是网段
谢谢yongjian

zaiwen

I had the same problem as you before, so I know exactly what's wrong.

NIS有办法限制单个的IP!!!  Read /var/yp/securenets carefully and the second paragraph says:

#               One can use the word "host" instead of a netmask of
#               255.255.255.255. Only IP addresses are allowed in this
#               file, not hostnames.
#
# Always allow access for localhost
255.0.0.0       127.0.0.0

# This line gives access to everybody. PLEASE ADJUST!
#0.0.0.0                0.0.0.0
host                    192.168.0.3
***********************************************

You see, just use the word "host" and the IP address you want to block

cxfcxf

wow  it's so cool~~
thanks~~
i think iptables isn't a best way to set limit for a service

yongjian

Post by zaiwen
I had the same problem as you before, so I know exactly what's wrong.

NIS有办法限制单个的IP!!!  Read /var/yp/securenets carefully and the second paragraph says:

#               One can use the word "host" instead of a netmask of
#               255.255.255.255. Only IP addresses are allowed in this
#               file, not hostnames.
#
# Always allow access for localhost
255.0.0.0       127.0.0.0

# This line gives access to everybody. PLEASE ADJUST!
#0.0.0.0                0.0.0.0
host                    192.168.0.3
***********************************************

You see, just use the word "host" and the IP address you want to block

Great! That's good to know.